Fort Smith changes story on computer system attack origin; law firm hired

The city of Fort Smith is now saying a massive computer system attack first made public on Aug. 16 did not originate in the Fort Smith Police Department (FSPD). But the city is now not identifying a specific location, saying instead that the attack “originated in the City’s broader network.”

The disclosure that FSPD systems did not open the door to the computer system attack resulted from questions sent to the city Oct. 6 by Talk Business & Politics. The city did not provide responses until Thursday evening.

The city noted Sept. 15 that the “investigation determined that an unauthorized threat actor accessed the City’s systems through the Fort Smith Police Department and exfiltrated certain data.”

The city says it first identified a “cybersecurity event” on Aug. 16, but citing the ongoing investigation, has declined to provide any details how the attack impacted city information and operations. City officials have said personal and financial data of city residents, employees, or vendors was not compromised but have not provided investigation results to support that claim.

Potentially at risk is personal and financial information of 1,032 city employees and the more than 36,000 city residents and businesses with water/sewer accounts. Also at risk is important information vendors who have done or do business with the city.

Interlock Ransomware has claimed it was the entity that attacked the city of Fort Smith’s computer system, according to reports from Ransom-DB and DysruptionHub. Interlock claims it obtained 5,720 gigabytes, or 5.7 terabytes, of city data.

Interlock claims that it acquired a wide range of sensitive material – including photos – held by the police, water supply system information, and “computer systems and networks that support the operations of various departments of the city.” The claim by Interlock suggests that the issue is more than a simple hack that resulted in operational outages, and is – or was – most likely a ransomware operation with large-scale data exposure and data loss.

‘FURTHER INVESTIGATION’ In response to the Oct. 6 questions from Talk Business & Politics, the city said “further investigation” discovered a different entry point with the computer system attack.

“After further investigation, the response team determined that the incident did not originate in the Fort Smith Police Department,” the city said. “It originated in the City’s broader network and then spread to the Police Department and other City systems.”

The city also reports that the investigation is ongoing more than three weeks after City Administrator Jeff Dingman said on Sept. 15 that a month-long investigation into an attack on the city’s computer system is nearing a conclusion , “and we have assurance that the threat has been contained.”

Also, the city has hired Devon, Pa.-based Mullen Coughlin LLC as outside counsel for breach-notification compliance. The Mullen Coughlin website notes that the law firm has the “largest team of experienced attorneys uniquely focused on providing tailored data privacy and incident response services, including breach response, pre-breach planning and compliance, regulatory investigation and management, and privacy litigation defense under the umbrella of cyber insurance.”

QUESTIONS AND ANSWERS Following are the Talk Business & Politics questions and responses from the city.

TBP: Is the investigation into the source of the system attack concluded? If not, when does the city anticipate being able to provide more information the attack?

The city reported preliminary findings before the investigation concluded. While the investigation continues into how this incident occurred, system recovery is underway, and we will provide further updates as more information is confirmed.

TBP: Is the city still certain that damage from the attack is contained?

Yes. Based on our IT team’s and cybersecurity partners’ findings, the City is confident the attack has been contained.

TBP: Does the city know if any information obtained by the attack is being sold on what is commonly known as the dark web? If so, please provide information what the city knows such information.

The City is aware of a posting on a dark web site purportedly containing data copied from the City’s network. The City is not aware of whether any data is being sold.

TBP: Did the attack originate in the Fort Smith Police Department? If not, where did the attack begin?

After further investigation, the response team determined that the incident did not originate in the Fort Smith Police Department. It originated in the City’s broader network and then spread to the Police Department and other City systems.

TBP: Did the city have measures in place to prevent an attack in one area from being allowed to hit multiple city departments?

Yes, the City had and has controls in place, which are required to obtain and maintain cybersecurity insurance.

TBP: Did the city fire and/or discontinue using a certain person and/or company during or after the investigation because of concerns with results of the effort and/or post-investigation findings that were in conflict with initial investigation results?

TBP: Has any ransom payment – including any payment/fee to an intermediary to avoid the classification of a ransom payment – been authorized or made in connection with this incident? If so, what was the amount? If a payment were made, would it appear as a line item in any city budget/expenditure report, and under what category?

The City did not pay a ransom or authorize or make any payment through an intermediary in connection with this incident.

TBP: Has the city made a determination under the Arkansas Personal Information Protection Act ( as to whether personal information was accessed by an unauthorized party? What is the legal deadline for that determination, and has the city met or missed it?

The City continues to work to understand the full scope of data at risk, which will guide any notifications necessary under the Arkansas Personal Information Protection Act. The City cannot on legal deadlines; however, it promptly reported this event to federal and state governmental partners and has been actively coordinating with them as the City’s incident response efforts progress.

TBP: Has outside counsel been retained specifically for breach-notification compliance, or is the city using Daily & Woods? If outside counsel has been secured, either independently or to support Daily & Woods, please provide the name of the firm.

Yes, Mullen Coughlin LLC.

TBP: What is the total cost incurred by the city to date for incident response? If the city is unwilling or unable to provide a precise cost, please provide an approximate amount.

Given the active and ongoing response efforts, the City cannot on the associated costs. The City has notified and activated its cyber insurance in response to this event to help defray the financial impact. Once the response is finalized, the City will disclose any costs as required.

TBP: What is the total estimated cost the city may pay for investigation costs, equipment replacement, new or added software fees, legal fees, and overtime pay for incident response?

As mentioned, the City’s response efforts are ongoing. The City is not in a position to on such costs at this time. The City has been coordinating with its cyber insurance carrier to mitigate the financial impact. Once the response is finalized, the City will disclose any costs as required.